Privacy and Quaero's Quest for the Perfect Search Engine: Threats - - PowerPoint PPT Presentation

Michael Zimmer, PhD

Fellow, Information Society Project Yale Law School

Privacy and Quaero's Quest for the Perfect Search Engine: Threats and Opportunities

• 1. Perfect Search Engine: 10100
• 2. Faustian Bargain
• 3. Quaero’s Perfect Search
• 4. Threats & Opportunities

Privacy and Quaero's Quest for the Perfect Search Engine: Threats and Opportunities

3

Perfect Search Engine

• “process and understand all the

information in the world”

– perfect reach

• “understand exactly what you mean and

give back exactly what you want”

– perfect recall

“Like the mind of God”

4

Perfect Reach

“Organize the world’s information and make it universally accessible and useful.”

5

Perfect Reach

• God-like omnipotence
• Personal data previously obscure is

now searchable

– Usenet posts – Court documents – Old, incorrect news articles – Images, video, blog comments, etc.

6

Perfect Recall

• Provide results that suit the context and intent
• f the search query:

“Paris Hilton”

• User satisfaction & loyalty
• Increased revenues

7

Perfect Recall

• God-like of omniscience
• Collect as much information as possible

about the searcher

– Server logs – Cookies – User accounts

8

Server Logs

123.45.67.89 - 25/Mar/2003 10:15:32 -

http://www.google.com/search?q= join+alcoholics+anonymous

Firefox 1.0.7; Windows NT 5.1 - 740674ce2123e969

IP Address Date & Time Cookie ID Search terms: Join Alcoholics Anonymous Also likely includes results clicked, referring page, and other clickstream data

9

Perfect Recall

• Over two dozen products & services
• Interconnected via cookies & Google

Accounts

• Contacts, news, subscriptions, blogs, books,

stocks, appointments, e-mail, friends, computer files, discussion groups, URLs…

10

Faustian Bargain

• Perfect search engine promises

breadth, depth, efficiency, and relevancy…

• …but lose “security via obscurity”
• …and involves the widespread capture
• f personal and intellectual information

Will Quaero offer to re-negotiate this Faustian bargain?

11

Quaero’s Perfect Search

• Combined sound, image and video search
• Technologically sophisticated, professional

search applications

• Index of cultural heritage
• Public-private initiative

Offers both threats & opportunities to preserve user privacy…

12

Privacy Threats: Reach

• Technologically sophisticated

multimedia search: a possible scenario

– User-generated content – Tagging: GPS data, date & time – Facial recognition

• While increasing Quaero’s reach, these

combine into possible privacy threats…

13

14

GPS: 40.75704, - 73.98597 Date: 10-Sept-2007 Time: 20:25 Camera: Nokia N95

15

16

Privacy Threats: Reach

• These are cute, user-generated

examples

• But more serious threats persist when

indexing images of events of more cultural and historical importance

17

Surveillance Protest

18

Gay Pride March

19

Neo-Nazi Demonstration

20

Privacy Threats: Reach

• Great value in user-contributed images
• And image recognition systems make

search more powerful

• But must not allow a new Faustian

bargain to emerge

– Just because in public doesn’t mean image should be identified, indexed and searched – Unfounded association, assumptions, discrimination, etc.

21

Privacy Threats: Recall

• Similar threats persist with potential

logging of user search activity

• What will it mean to have one’s search

history tied to controversial or illegal subjects?

– Holocaust denial information – Historical meeting places for Islamic radicals

More harmful than what Google knows about me?

22

Opportunity

• Value-conscious design

– Include values of moral & ethical import in initial design process – Pragmatic engagement & collaboration with technical designers

• Too late to engage with Google

– Recent changes trivial

• But designers of Quaero can build in

values from the ground-up

23

Wikia Search Model

• Transparency

– Openness in how the systems and algorithms

• perate
• Community

– Everyone is able to contribute in some way; strong social and community focus.

• Quality

– Significantly improve the relevancy and accuracy

• f search results and the searching experience.
• Privacy

– Must be protected, do not store or transmit any identifying data.

24

Design for Privacy

• 1. Quaero must be designed in such a way as

to prevent any substantive response to a civil or criminal subpoena of user activity

• 2. Quaero must be designed so IP addresses

and cookies cannot be associated with particular users or accounts

• 3. Query traffic must be encrypted to prevent

'man in the middle' monitoring

• 4. Quaero must provide transparency in the

data it collects about users, how it is used, who uses it, and how long it is retained

25

Design for Privacy

• 5. Quaero must not engage in personalized or

behaviorally-targeted advertising

• 6. Quaero must take steps to remove or
• bscure personally-identifiable images

(faces, license plates, etc) from its searchable index

• 7. Quaero must provide individuals the ability

to remove or obscure personally-identifiable data from its searchable index

• 8. Quaero must provide users the ability to

view, edit, and delete any search history data associated with their account

26

Summary

• Unique proposition

– Build a robust, sophisticated search engine

• f cultural knowledge and history

– Relatively unfettered by traditional market forces

• Unique opportunity

– Design for values – Protect user privacy – Avoid another Faustian bargain with “the mind of God”

Michael Zimmer, PhD

Fellow, Information Society Project Yale Law School michael.zimmer@yale.edu Http://michaelzimmer.org

Privacy and Quaero's Quest for the Perfect Search Engine: Threats and Opportunities